Design and functionality

SURE provides a uniquely simple and secure solution to the problem of transferring and storing sensitive data contained in registries, routinely collected datasets and cohorts for the purposes of research and analysis. These data are currently underused in research projects due to privacy concerns. SURE users can access this type of data through virtual workspaces and while they access the data from their own computers, the data never leave SURE.

The data cannot be copied, downloaded or transmitted by email or other means. Researchers can take their analyses from SURE but not the original data. All inputs and outputs are vetted through a unique “curated gateway” for compliance and the SURE system records and archives all transactions for future reference.

SURE security features

Purpose-built privacy protection

  • SURE operates as a central, secure, online destination for analysing sensitive human research data, and allows data custodians tight control over what they make available and to whom.
  • Purpose-built technology, which is internationally unique, automates and manages the information flow in and out of SURE
  • SURE overcomes the major privacy challenges, reputational and legal liability risks associated with releasing data to external parties.

Access control

  • SURE access is strongly authenticated requiring three different factors of authentication
  • SURE is hosted in a tier-3+ (i.e. best available) data centre in Sydney that is also used by some of Australia’s leading telecommunications, government and financial institutions.
  • Regular on-site and off-site backups of data are made. All off-site backups and archival data are encrypted prior to being transferred to secure off-site storage
  • All users are required to undertake training on issues of privacy, ethics, information security and statistical disclosure control prior to gaining access to SURE and sign a deed outlining the terms and conditions of using SURE

SURE Data and Workspace Validation Procedures

Data Validation Procedures

Inbound
  • Files being moved into a SURE workspace are uploaded to the External Curated Gateway
  • During upload all files are verified for size before being made available for review
  • The next step in the review process is for all files to be scanned for viruses and transferred from the external curated gateway to the internal curated gateway
  • Uploaded files are reviewed by the Workspace Curator in the Internal Curated Gateway
  • If the Curator approves the files for use in SURE, the Internal Curated Gateway will allow project team members to download into the SURE workspace.
Outbound
  • Files to be downloaded from a SURE workspace to a local drive for publication or reporting are uploaded to the Internal Curated Gateway
  • Uploaded files are reviewed by the Workspace Curator in the Internal Curated Gateway (unit record level data is not allowed to be removed from SURE workspaces)
  • If the Curator approves the files for use outside of SURE, the External Curated Gateway will allow download (for a period of two weeks) to the users local drives.

Workspace Validation Procedures

  • HREC approvals, and data custodian approvals, for the research being undertaken, must be provided to the Sax Institute prior to setting up the workspace
  • An Agreement governing the use and provision of the workspace must be established between the research organisation and the Sax Institute
  • Researcher Deeds governing the activities of researchers must be established for each researcher accessing the workspace
  • Changes to personnel accessing the workspace must be accompanied by evidence of revised HREC approvals
  • Each SURE User is required to successfully complete a SURE training course before access to SURE is provided.